import net.shibboleth.utilities.java.support.resolver.ResolverException; //导入依赖的package包/类
/** {@inheritDoc} */
@Override
protected void doInvoke(@Nonnull final MessageContext messageContext) throws MessageHandlerException {
    ComponentSupport.ifNotInitializedThrowUninitializedComponentException(this);
    // Resolve client id from inbound message
    final ClientID clientId = RequestFieldResolver.getClientID((AbstractRequest) messageContext.getMessage());
    // Resolve metadata for client id
    final ClientIDCriterion clientCriterion = new ClientIDCriterion(clientId);
    final CriteriaSet criteria = new CriteriaSet(clientCriterion);
    try {
        final OIDCClientInformation clientInformation = clientResolver.resolveSingle(criteria);
        if (clientInformation == null) {
            log.warn("{} No client information returned for {}", getLogPrefix(), clientId);
            return;
        }
        final OIDCMetadataContext oidcCtx = new OIDCMetadataContext();
        oidcCtx.setClientInformation(clientInformation);
        messageContext.addSubcontext(oidcCtx);
        // Based on that info we know 1) client is valid 2) we know valid
        // redirect uris
        log.debug("{} {} added to MessageContext as child of {}", getLogPrefix(),
                OIDCMetadataContext.class.getName(), messageContext.getClass().getName());
    } catch (ResolverException e) {
        log.error("{} ResolverException thrown during client information lookup", getLogPrefix(), e);
    }
}
 

import net.shibboleth.utilities.java.support.resolver.ResolverException; //导入依赖的package包/类
/**
 * Converts an InputStream into a byte array.
 * 
 * @param ins input stream to convert
 * 
 * @return resultant byte array
 * 
 * @throws ResolverException thrown if there is a problem reading the resultant byte array
 */
public static byte[] inputstreamToByteArray(InputStream ins) throws ResolverException {
    try {
        // 1 MB read buffer
        byte[] buffer = new byte[1024 * 1024];
        ByteArrayOutputStream output = new ByteArrayOutputStream();

        int n = 0;
        while (-1 != (n = ins.read(buffer))) {
            output.write(buffer, 0, n);
        }

        ins.close();
        return output.toByteArray();
    } catch (IOException e) {
        throw new ResolverException(e);
    }
}
 

import net.shibboleth.utilities.java.support.resolver.ResolverException; //导入依赖的package包/类
/** {@inheritDoc} */
@Override @Nonnull public Iterable<OIDCClientInformation> resolve(final CriteriaSet criteria) 
        throws ResolverException {

    ComponentSupport.ifNotInitializedThrowUninitializedComponentException(this);
    ServiceableComponent<ClientInformationResolver> component = null;
    try {
        component = service.getServiceableComponent();
        if (null == component) {
            log.error("RelyingPartyClientInformationProvider '{}': Error accessing underlying source: "
                    + "Invalid configuration.", getId());
        } else {
            final ClientInformationResolver resolver = component.getComponent();
            return resolver.resolve(criteria);
        }
    } catch (final ResolverException e) {
        log.error("RelyingPartyClientInformationProvider '{}': Error during resolution", getId(), e);
    } finally {
        if (null != component) {
            component.unpinComponent();
        }
    }
    return Collections.EMPTY_SET;
}
 

import net.shibboleth.utilities.java.support.resolver.ResolverException; //导入依赖的package包/类
/** {@inheritDoc} */
@Override @Nullable public OIDCClientInformation resolveSingle(final CriteriaSet criteria) 
        throws ResolverException {

    ComponentSupport.ifNotInitializedThrowUninitializedComponentException(this);
    ServiceableComponent<ClientInformationResolver> component = null;
    try {
        component = service.getServiceableComponent();
        if (null == component) {
            log.error("RelyingPartyClientInformationProvider '{}': Error accessing underlying source: "
                    + "Invalid configuration.", getId());
        } else {
            final ClientInformationResolver resolver = component.getComponent();
            return resolver.resolveSingle(criteria);
        }
    } catch (final ResolverException e) {
        log.error("RelyingPartyResolver '{}': Error during resolution", getId(), e);
    } finally {
        if (null != component) {
            component.unpinComponent();
        }
    }
    return null;
}
 

import net.shibboleth.utilities.java.support.resolver.ResolverException; //导入依赖的package包/类
/** {@inheritDoc} */
@Override
protected OIDCProviderMetadata parse(byte[] bytes) throws ParseException {
    final OIDCProviderMetadata result = OIDCProviderMetadata.parse(JSONObjectUtils.parse(new String(bytes)));
    final JSONObject jsonResult = result.toJSONObject();
    for (final String key : dynamicResolvers.keySet()) {
        log.debug("Starting to resolve value for {}", key);
        final RefreshableMetadataValueResolver resolver = dynamicResolvers.get(key);
        try {
            resolver.refresh();
            final Object value = resolver.resolveSingle(null);
            if (value != null) {
                jsonResult.put(key, value);
                log.debug("The field {} updated to the result", key);
            }
        } catch (ResolverException e) {
            log.warn("Could not resolve a value for {̛}, ignoring it.", key, e);
        }
    }
    return OIDCProviderMetadata.parse(jsonResult);
}
 

import net.shibboleth.utilities.java.support.resolver.ResolverException; //导入依赖的package包/类
/**
 * Get list of information matching a given identifier.
 * 
 * @param identifier identifier to lookup
 * @return a list of information
 * @throws ResolverException if an error occurs
 */
@Nonnull @NonnullElements protected List<Value> lookupIdentifier(
        @Nonnull @NotEmpty final Key identifier)
        throws ResolverException {
    if (!isInitialized()) {
        throw new ResolverException("Metadata resolver has not been initialized");
    }

    if (identifier == null || Strings.isNullOrEmpty(identifier.getValue())) {
        log.debug("Identifier was null or empty, skipping search for it");
        return Collections.emptyList();
    }

    List<Value> allInformation = lookupIndexedIdentifier(identifier);
    if (allInformation.isEmpty()) {
        log.debug("Backing store does not contain any information with the ID: {}", identifier);
        return allInformation;
    }
    return allInformation;
}
 

import net.shibboleth.utilities.java.support.resolver.ResolverException; //导入依赖的package包/类
/** {@inheritDoc} */
@Override
@Nonnull public Iterable<OIDCClientInformation> resolve(@Nullable final CriteriaSet criteria) 
        throws ResolverException {
    ComponentSupport.ifNotInitializedThrowUninitializedComponentException(this);

    for (final ClientInformationResolver resolver : resolvers) {
        try {
            final Iterable<OIDCClientInformation> clientInformations = resolver.resolve(criteria);
            if (clientInformations != null && clientInformations.iterator().hasNext()) {
                return clientInformations;
            }
        } catch (final ResolverException e) {
            log.warn("Error retrieving client information from resolver of type {}, proceeding to next resolver",
                    resolver.getClass().getName(), e);
            continue;
        }
    }

    return Collections.emptyList();
}
 

import net.shibboleth.utilities.java.support.resolver.ResolverException; //导入依赖的package包/类
/** {@inheritDoc} */
@Override
protected byte[] fetchMetadata() throws ResolverException {
    try {
        ResolverHelper.validateMetadataFile(metadataFile);
        DateTime metadataUpdateTime = getMetadataUpdateTime();
        if (getLastRefresh() == null || getLastUpdate() == null || metadataUpdateTime.isAfter(getLastRefresh())) {
            log.debug("Returning the contents of {} as byte array", metadataFile.toPath());
            return ResolverHelper.inputstreamToByteArray(new FileInputStream(metadataFile));
        }
        return null;
    } catch (IOException e) {
        String errMsg = "Unable to read metadata file " + metadataFile.getAbsolutePath();
        log.error(errMsg, e);
        throw new ResolverException(errMsg, e);
    }
}
 

import net.shibboleth.utilities.java.support.resolver.ResolverException; //导入依赖的package包/类
public URI getSingleSignOn(String entityId) {
    EntityDescriptor idpEntityDescriptor;
    try {
        CriteriaSet criteria = new CriteriaSet(new EntityIdCriterion(entityId));
        idpEntityDescriptor = metadataProvider.resolveSingle(criteria);
    } catch (ResolverException e) {
        LOG.error(format("Exception when accessing metadata: {0}", e));
        throw propagate(e);
    }

    if(idpEntityDescriptor!=null) {
        final IDPSSODescriptor idpssoDescriptor = idpEntityDescriptor.getIDPSSODescriptor(SAMLConstants.SAML20P_NS);
        final List<SingleSignOnService> singleSignOnServices = idpssoDescriptor.getSingleSignOnServices();
        if (singleSignOnServices.isEmpty()) {
            LOG.error(format("No singleSignOnServices present for IDP entityId: {0}", entityId));
        } else {
            if (singleSignOnServices.size() > 1) {
                LOG.warn(format("More than one singleSignOnService present: {0} for {1}", singleSignOnServices.size(), entityId));
            }
            return URI.create(singleSignOnServices.get(0).getLocation());
        }
    }

    throw ApplicationException.createUnauditedException(ExceptionType.NOT_FOUND, UUID.randomUUID(), new RuntimeException(format("no entity descriptor for IDP: {0}", entityId)));

}
 

import net.shibboleth.utilities.java.support.resolver.ResolverException; //导入依赖的package包/类
public void validateAll() {
    try {
        Iterable<EntityDescriptor> entityDescriptors = metadataResolver.resolve(new CriteriaSet(new EntityIdCriterion(hubFederationId)));
        entityDescriptors.forEach(entityDescriptor -> {
            String entityID = entityDescriptor.getEntityID();
            if (hubEntityId.equals(entityDescriptor.getEntityID())) {
                metadataCertificatesRepository.getHubEncryptionCertificates(entityID);
                metadataCertificatesRepository.getHubSigningCertificates(entityID);
            } else {
                metadataCertificatesRepository.getIdpSigningCertificates(entityID);
            }
        });
    } catch (ResolverException e) {
        throw new InvalidSamlMetadataException("Metadata could not be read from the metadata service", e);
    }
}
 

import net.shibboleth.utilities.java.support.resolver.ResolverException; //导入依赖的package包/类
public Document getMatchingServiceAdapterMetadata() throws ResolverException, FederationMetadataLoadingException {
    EntitiesDescriptor entitiesDescriptor = new EntitiesDescriptorBuilder().buildObject();
    entitiesDescriptor.setValidUntil(DateTime.now().plusHours(1));

    final EntityDescriptor msaEntityDescriptor = createEntityDescriptor(msaConfiguration.getEntityId());
    final OpenSamlXmlObjectFactory openSamlXmlObjectFactory = new OpenSamlXmlObjectFactory();
    msaEntityDescriptor.getRoleDescriptors().add(getAttributeAuthorityDescriptor(openSamlXmlObjectFactory));
    msaEntityDescriptor.getRoleDescriptors().add(getIdpSsoDescriptor(openSamlXmlObjectFactory));

    entitiesDescriptor.getEntityDescriptors().add(msaEntityDescriptor);

    if (matchingServiceAdapterConfiguration.shouldRepublishHubCertificates()) {
        entitiesDescriptor.getEntityDescriptors().add(getHubEntityDescriptor());
    }

    return entitiesDescriptorElementTransformer.apply(entitiesDescriptor).getOwnerDocument();
}
 

import net.shibboleth.utilities.java.support.resolver.ResolverException; //导入依赖的package包/类
@Test
public void shouldHaveAnIDPSSODescriptor() throws ResolverException, FederationMetadataLoadingException {
    when(certificateStore.getSigningCertificates()).thenReturn(asList(getCertificate()));

    Document matchingServiceAdapterMetadata = matchingServiceAdapterMetadataRepository.getMatchingServiceAdapterMetadata();
    EntityDescriptor msa = getEntityDescriptor(matchingServiceAdapterMetadata, entityId);

    assertThat(msa.getRoleDescriptors().size()).isEqualTo(2);
    IDPSSODescriptor idpssoDescriptor = msa.getIDPSSODescriptor(SAMLConstants.SAML20P_NS);
    assertThat(idpssoDescriptor).isNotNull();
    assertThat(idpssoDescriptor.getSingleSignOnServices()).hasSize(1);
    assertThat(idpssoDescriptor.getSingleSignOnServices().get(0).getLocation()).isEqualTo(hubSsoEndPoint);

    // Shibboleth SP doesn't like the xsi:type="md:EndpointType" attribute on the SingleSignOnService element:
    assertThat(idpssoDescriptor.getSingleSignOnServices().get(0).getSchemaType()).isNull();

    assertThat(idpssoDescriptor.getKeyDescriptors()).hasSize(1);
}
 

import net.shibboleth.utilities.java.support.resolver.ResolverException; //导入依赖的package包/类
@Test
public void shouldValidateAttributeQuerySuccessfully() throws ResolverException {
    final EncryptedAssertion encryptedAssertion = anAssertion().addAuthnStatement(anAuthnStatement().build()).withConditions(aConditions()).build();
    final String requestId = "request-id";
    final AttributeQuery attributeQuery = anAttributeQuery()
        .withIssuer(anIssuer().withIssuerId(HUB_ENTITY_ID).build())
        .withSignature(
            aSignature()
                .withSigningCredential(
                    new TestCredentialFactory(
                        HUB_TEST_PUBLIC_SIGNING_CERT,
                        HUB_TEST_PRIVATE_SIGNING_KEY
                    ).getSigningCredential()
                ).build()
        )
        .withId(requestId)
        .withSubject(aSubjectWithEncryptedAssertion(encryptedAssertion, requestId, HUB_ENTITY_ID))
        .build();
    when(assertionDecrypter.decryptAssertions(any())).thenReturn(Arrays.asList(anEidasAssertion().withConditions(aConditions()).buildUnencrypted()));

    Messages messages = validator.validate(attributeQuery, messages());

    assertThat(messages.size()).isEqualTo(0);
    assertThat(messages.hasErrors()).isFalse();
}
 

import net.shibboleth.utilities.java.support.resolver.ResolverException; //导入依赖的package包/类
@Test
public void shouldReturnErrorWhenAttributeQueryIssuerValidationFails() throws ResolverException {
    final EncryptedAssertion encryptedAssertion = anAssertion().build();
    final Assertion assertion = anAssertion().addAuthnStatement(anAuthnStatement().build()).buildUnencrypted();
    final String requestId = "request-id";
    final AttributeQuery attributeQuery = anAttributeQuery()
        .withIssuer(anIssuer().withIssuerId("").build())
        .withSignature(
            aSignature()
                .withSigningCredential(
                    new TestCredentialFactory(
                        HUB_TEST_PUBLIC_SIGNING_CERT,
                        HUB_TEST_PRIVATE_SIGNING_KEY
                    ).getSigningCredential()
                ).build()
        )
        .withId(requestId)
        .withSubject(aSubjectWithEncryptedAssertion(encryptedAssertion, requestId, HUB_ENTITY_ID))
        .build();
    when(assertionDecrypter.decryptAssertions(any())).thenReturn(Arrays.asList(assertion));

    Messages messages = validator.validate(attributeQuery, messages());

    assertThat(messages.hasErrorLike(DEFAULT_ISSUER_EMPTY_MESSAGE)).isTrue();
}
 

import net.shibboleth.utilities.java.support.resolver.ResolverException; //导入依赖的package包/类
@Test
public void shouldReturnErrorWhenAttributeQuerySignatureValidationFails() throws ResolverException {
    final EncryptedAssertion encryptedAssertion = anAssertion().withConditions(aConditions()).build();
    final String requestId = "request-id";
    final AttributeQuery attributeQuery = anAttributeQuery()
        .withIssuer(anIssuer().withIssuerId(HUB_ENTITY_ID).build())
        .withSignature(
            aSignature()
                .withSigningCredential(
                    new TestCredentialFactory(
                        TEST_RP_PUBLIC_SIGNING_CERT,
                        TEST_RP_PRIVATE_SIGNING_KEY
                    ).getSigningCredential()
                ).build()
        )
        .withId(requestId)
        .withSubject(aSubjectWithEncryptedAssertion(encryptedAssertion, requestId, HUB_ENTITY_ID))
        .build();
    when(assertionDecrypter.decryptAssertions(any())).thenReturn(Arrays.asList(anEidasAssertion().withConditions(aConditions()).buildUnencrypted()));

    Messages messages = validator.validate(attributeQuery, messages());

    assertThat(messages.hasErrorLike(DEFAULT_INVALID_SIGNATURE_MESSAGE)).isTrue();
}
 

import net.shibboleth.utilities.java.support.resolver.ResolverException; //导入依赖的package包/类
@Test
public void shouldReturnErrorWhenAnEncryptedAssertionValidationFails() throws ResolverException {
    final EncryptedAssertion encryptedAssertion = anAssertion().withIssuer(anIssuer().withIssuerId("").build()).build();
    final Assertion assertion = anAssertion().addAuthnStatement(anAuthnStatement().build()).withIssuer(anIssuer().withIssuerId("").build()).buildUnencrypted();
    final String requestId = "request-id";
    final AttributeQuery attributeQuery = anAttributeQuery()
        .withIssuer(anIssuer().withIssuerId(HUB_ENTITY_ID).build())
        .withSignature(
            aSignature()
                .withSigningCredential(
                    new TestCredentialFactory(
                        HUB_TEST_PUBLIC_SIGNING_CERT,
                        HUB_TEST_PRIVATE_SIGNING_KEY
                    ).getSigningCredential()
                ).build()
        )
        .withId(requestId)
        .withSubject(aSubjectWithEncryptedAssertion(encryptedAssertion, requestId, HUB_ENTITY_ID))
        .build();
    when(assertionDecrypter.decryptAssertions(any())).thenReturn(Arrays.asList(assertion));


    Messages messages = validator.validate(attributeQuery, messages());

    assertThat(messages.hasErrorLike(generateEmptyIssuerMessage(IDENTITY_ASSERTION))).isTrue();
}
 

import net.shibboleth.utilities.java.support.resolver.ResolverException; //导入依赖的package包/类
@Test
public void shouldReturnErrorWhenAnEncryptedAssertionIsMissing() throws ResolverException {
    final AttributeQuery attributeQuery = anAttributeQuery()
        .withIssuer(anIssuer().withIssuerId(HUB_ENTITY_ID).build())
        .withSignature(
            aSignature()
                .withSigningCredential(
                    new TestCredentialFactory(
                        HUB_TEST_PUBLIC_SIGNING_CERT,
                        HUB_TEST_PRIVATE_SIGNING_KEY
                    ).getSigningCredential()
                ).build()
        )
        .withSubject(null)
        .build();

    Messages messages = validator.validate(attributeQuery, messages());

    assertThat(messages.size()).isEqualTo(1);
    assertThat(messages.hasErrorLike(EidasAttributeQueryValidator.DEFAULT_ENCRYPTED_ASSERTIONS_MISSING_MESSAGE)).isTrue();
}
 

import net.shibboleth.utilities.java.support.resolver.ResolverException; //导入依赖的package包/类
@Test
public void shouldReturnErrorWhenAttributeQueryContainsAnEmptySubjectConfirmation() throws ResolverException {
    final AttributeQuery attributeQuery = anAttributeQuery()
        .withIssuer(anIssuer().withIssuerId(HUB_ENTITY_ID).build())
        .withSignature(
            aSignature()
                .withSigningCredential(
                    new TestCredentialFactory(
                        HUB_TEST_PUBLIC_SIGNING_CERT,
                        HUB_TEST_PRIVATE_SIGNING_KEY
                    ).getSigningCredential()
                ).build()
        )
        .withSubject(aSubject().withSubjectConfirmation(null).build())
        .build();

    Messages messages = validator.validate(attributeQuery, messages());

    assertThat(messages.size()).isEqualTo(1);
    assertThat(messages.hasErrorLike(EidasAttributeQueryValidator.DEFAULT_ENCRYPTED_ASSERTIONS_MISSING_MESSAGE)).isTrue();
}
 

import net.shibboleth.utilities.java.support.resolver.ResolverException; //导入依赖的package包/类
/** {@inheritDoc} */
@Override
public Iterable<OIDCClientInformation> resolve(CriteriaSet criteria) throws ResolverException {
    ComponentSupport.ifNotInitializedThrowUninitializedComponentException(this);
    ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);

    final ClientIDCriterion clientIdCriterion = criteria.get(ClientIDCriterion.class);
    if (clientIdCriterion == null || clientIdCriterion.getClientID() == null) {
        log.warn("No client ID criteria found, returning empty set.");
        return Collections.emptyList();
    }
    //TODO: support other criterion
    final String clientId = clientIdCriterion.getClientID().getValue();
    final List<OIDCClientInformation> result = new ArrayList<>();
    try {
        final StorageRecord record = getStorageService().read(CONTEXT_NAME, clientId);
        if (record == null) {
            log.error("Could not find any records with clientId {}", clientId);
        } else {
            final OIDCClientInformation clientInformation = 
                    OIDCClientInformation.parse(JSONObjectUtils.parse(record.getValue()));
            log.debug("Found a record with clientId {}", clientId);
            result.add(clientInformation);
        }
    } catch (IOException | ParseException e) {
        log.error("Could not read the storage data", e);
    }
    return result;
}
 

import net.shibboleth.utilities.java.support.resolver.ResolverException; //导入依赖的package包/类
/** {@inheritDoc} */
@Override
public OIDCClientInformation resolveSingle(CriteriaSet criteria) throws ResolverException {
    final Iterable<OIDCClientInformation> iterable = resolve(criteria);
    if (iterable != null) {
        final Iterator<OIDCClientInformation> iterator = iterable.iterator();
        if (iterator != null && iterator.hasNext()) {
            return iterator.next();
        }
    }
    log.warn("Could not find any clients with the given criteria");
    return null;
}